ab

Support of regular/legacy opcodes have been removed since 5.1/6.0. So we can't connect to any new version of MongoDB with this driver. https://www.mongodb.com/docs/v6.0/reference/mongodb-wire-protocol/#opcodes OP_MSG needs to be used for all...

Shouldn't pre-computed HTTP headers trigger "Stripped" classification?

10

Reading general requirement number 2 : > This project intends to measure performance of production-grade deployments of real-world web application frameworks and platforms. All implementations are expected (but not required)...

/updates should be validated

5

### OS (Please include kernel version) All ### Expected Behavior Calling `/updates` should actually update the database for all frameworks. The TFB validation bot should validate this expected behavior. ###...

The JSON/TDocVariant as returned by mormot.soa.codegen.pas seems to be broken, in respect to mORMot 1. We can't properly use the existing templates. Please see https://synopse.info/forum/viewtopic.php?id=5835

Node.js Client Gives Wrong results

4

The client code has several limitations, as reported by https://components4developers.blog/2021/11/02/http-middleware-benchmarks: > It turns out that the Node.js client benchmark actually do create the number of connections, but it will never...

WinARM Preliminary Support

1

Windows on 64-bit ARM is a fact, with existing nice hardware (mostly laptops) around. Goal of this issue is to see how far we could use FPC trunk to compile...

Use HTTP server as web proxy with cache

1

A caching logic, similar to the PeerCache local temporary cache, is to be used. For a given URI, e.g. https://mormotcache.ad.company.com/*, we redirect to another server So that e.g. `https://mormotcache.ad.company.com/https/srvorigin.ad.company.com/application/file` will...

Implementing Argon2 in pure pascal is not an option for us, since the algorithm seems too complex, and alternatives like BCrypt and SCrypt are already available, with very efficient code....

We could implement a standard Security log to our toolbox, as we also offer standard HTTP logs for our web servers. The following cheat sheet may help: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html

Currently, our SSPI/GSSAPI code supports a single client/server roundtrip. If is fine with most NEGOTIATE/Kerberos authentication patterns, but may not be the case e.g. when credential delegation or cross-realm referrals...